DNS and ICF

  • Thread starter Thread starter Peter och Maria Rydqvist
  • Start date Start date
P

Peter och Maria Rydqvist

Hi!

I would like to use ICF in Windows 2003, but the server is also a DNS
Server and I haven't figured out how to open up the epheremal ports
(1025-65535) on the Internet Connection Firewall.

Does anyone know if this is possible, and if so, how?

/Peter
 
In
Peter och Maria Rydqvist said:
Hi!

I would like to use ICF in Windows 2003, but the server is also a DNS
Server and I haven't figured out how to open up the epheremal ports
(1025-65535) on the Internet Connection Firewall.

Does anyone know if this is possible, and if so, how?

/Peter
Click to expand...

I haven't tried this, but if this is an internal server, I would disable ICF
to allow clients to connect to it easily. If you want to keep it enabled,
look in the ICF properties, in there you can open up those ports.

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.
This posting is provided "AS IS" with no warranties.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory
 
In

I haven't tried this, but if this is an internal server, I would disable ICF
to allow clients to connect to it easily. If you want to keep it enabled,
look in the ICF properties, in there you can open up those ports.

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.
This posting is provided "AS IS" with no warranties.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory
Click to expand...

Hi and thanks for the answer.

This is going to be an external machine, serving clients with DNS,
HTTP and FTP.

I would like to use the ICF to show only selected ports, 53, 80 and 21
to be exactly.

There's no problem with it except that I haven't found any
documentation on how to open up a port range. I don't want to open up
all port individually...

I could set DNS to use a specific port, but the less changes to the
machine's configuration, the better.

/Peter
 
In
Peter och Maria Rydqvist said:
Hi and thanks for the answer.

This is going to be an external machine, serving clients with DNS,
HTTP and FTP.

I would like to use the ICF to show only selected ports, 53, 80 and 21
to be exactly.

There's no problem with it except that I haven't found any
documentation on how to open up a port range. I don't want to open up
all port individually...

I could set DNS to use a specific port, but the less changes to the
machine's configuration, the better.

/Peter
Click to expand...

If that's what you want to do, and I agree the less changes the better, I
would rather recommend to use an entry point firewall/router such as an
inexpensive ($80.00 USD) Linksys with Firewall or Netgear, etc. There are
many to choose from. It will do exactly what you want.

You can also go with a personal firewall such as Zone Alarm or ISS' BlackIce
(about $40.00 USD), (there are others). They can do this with no problem.

I haven't really used ICF due to it;s limitations, but you can look under
the services tab in ICF and see if you can set it up in there:
How to Enable Internet Connection Firewall in Windows XP:
http://www.microsoft.com/windowsxp/pro/using/itpro/securing/enableicf.asp


--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.
This posting is provided "AS IS" with no warranties.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory
 
There isn't any need to open the ephemeral ports for the filter to work. All that is needed is the destination port. For instance, for DNS traffic the firewall is
expecting to receive data on UDP port 53. So any inbound traffic on UDP 53 is allowed in. That's all there is to it. Adding ephemeral ranges would expose too
much. For more details, please refer to 317530 HOW TO: Turn On the Internet Connection Firewall Feature in Windows
http://support.microsoft.com/?id=317530

Thank you,
Mike Johnston
Microsoft Network Support

--

This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this message are best directed to the newsgroup/thread from which they originated.
 
Back
Top